Curated tips on Kubernetes hardening, CI and supply-chain gating, API security, and AI-assisted fuzzing. Practical field notes from real infrastructure.
Run 11 checks on your GPU node pools: NVIDIA's own docs say time-sliced replicas get no memory or fault isolation, and DCGM cannot bill them.
Read more: Kubernetes GPU Sharing: 11 Checks, No Memory IsolationTerraform 1.17's -minimal-refresh skips unchanged resources, so -detailed-exitcode returns 0 while production drifts. 12 upgrade tips with commands.
Read more: Terraform 1.17 -minimal-refresh: drift exits 0 anywayRun the inventory before Kyverno v1.20 removes ClusterPolicy: validate.podSecurity has no CEL equivalent, and the new seccomp rule admits Pods PSA denies.
Read more: Kyverno ClusterPolicy Removal: podSecurity Has No CEL FixDiff pnpm pack against npm pack --dry-run before publishing: pnpm 12's Rust packlist can ship lib/index.js alone, and the registry accepts it.
Read more: pnpm publish missing files: 4 packlist fixes in 6 daysRun 11 checks on CVE-2026-48710: it sits on CISA KEV at CVSS 6.5, FastAPI sets no Starlette floor, and the sibling CVE needs 1.3.0, not 1.0.1.
Read more: Fix Starlette CVE-2026-48710: 1.0.1 Misses the SiblingNode 26 becomes Active LTS on 28 October, so lts/* and node:lts switch runtimes with no commit. Pin the major, rebuild native addons: ABI is now 147.
Read more: Node 26 LTS on Oct 28: node:lts Moves Without a CommitKubernetes 1.38 drops the cgroupDriver fallback, so containerd 1.x nodes never join. Run crictl runtime-config to find them, plus the gate that buys time.
Read more: containerd 1.x on Kubernetes 1.38: kubelet refuses to startRun kubelet --help on the 1.37 binary to catch the 18 removed cAdvisor flags before a node dies at parse. eventRecordQPS 0 now means unlimited.
Read more: Kubernetes 1.37 Drops 18 Kubelet Flags: Nodes Never JoinFilter RAG retrieval per principal: project ACLs onto every chunk, key the semantic cache on the principal, and prove it with a nightly canary suite.
Read more: Fix RAG Access Control: Your Chunks Carry No ACLScope MCP tool permissions by token and prove it: readOnlyHint is only a claim the server makes about itself. 10 tips with runnable checks.
Read more: MCP Tool Permissions: 10 Tips to Prove Agent Write AccessRun these checks to prove Kubernetes admission control is enforced: fail-open metrics, failurePolicy Ignore audit, ValidatingAdmissionPolicy, RBAC.
Read more: Stop Kubernetes Admission Control Failing Open: 11 TipsPin GitHub Actions by SHA, then close the 10 gaps the pin leaves: impostor commits, unverified provenance, and the checks that prove it in CI.
Read more: Pin GitHub Actions by SHA: 10 Gaps the Pin Leaves OpenCyber Resilience Act reporting starts 11 September 2026. Ten tips for the 24-hour clock, naming the right coordinating CSIRT, and a platform with no API.
Read more: Cyber Resilience Act Reporting: 10 Tips for Sept 118 of 10 OWASP LLM identifiers changed on 3 August 2026. If your policy says LLM06, it now points at Unbounded Consumption, not Excessive Agency.
Read more: OWASP LLM Top 10 2026: Your LLM06 Now Points at the Wrong RiskSet kube-proxy mode explicitly before Kubernetes 1.40 disables IPVS: nftables drops NodePort on secondary node IPs and silences your sync-failure alert.
Read more: kube-proxy IPVS to nftables: Fix 11 Traps in 1.40Run these 12 checks before helm upgrade to Cilium 1.19: ClusterMesh policy scoping flips, BGPv1 CRDs are gone, and five service flags vanish.
Read more: Cilium 1.19 Upgrade: Fix 12 Traps Before BGP Dropsnpm 12 exits 0 when it skips a native build, so your pipeline is green and the container crashes. Three causes share the same output; here is how to triage.
Read more: npm 12: npm ci Exits 0, build/Release Fails on Deploypnpm 12's Rust CLI validates pnpm-workspace.yaml, but only raises a hard error when you pin a version. Without one, a config typo stays a silent warning.
Read more: pnpm 12 Upgrade: Pin a Version or Workspace Errors Stay SilentMove Kubernetes off non-expiring ServiceAccount secrets to bound, projected tokens via the TokenRequest API, and fix the 401s the migration triggers.
Read more: Bound ServiceAccount Tokens: 9 Tips to Kill Static OnesWire GitHub Actions OIDC to AWS correctly: scope the sub claim, handle the July 15 immutable-claim change, and avoid the trust policy traps tutorials skip.
Read more: GitHub Actions OIDC to AWS: Drop Static Keys for GoodBattle-tested agentic SOC tips: gate autonomy on 90% shadow-mode concordance, split verdict from action, and treat every log line as attacker-authored.
Read more: Agentic SOC in 2026: 10 Tips for Safe TriageThe same AI fuzzers driving June's 206-CVE record run on a laptop with one LLM key. OSS-Fuzz-Gen, Buttercup, Atheris, ten exact commands.
Read more: AI Fuzzing: OSS-Fuzz-Gen Writes the Harness, You Run ItPgDog sits in front of unmodified Postgres as a pooler, read/write balancer, and sharder. Here are the sharp edges to map before it hits production traffic.
Read more: PgDog: Connection Pooling, Read Splits, and ShardingBattle-tested OWASP API Security Top 10 tips for 2026: hunt shadow and zombie APIs at runtime, test BOLA in CI, and close the gaps that breached Optus.
Read more: OWASP API Top 10: Shadow APIs and BOLA Tips for 2026Why LLM agent guardrails fail under adaptive attack, and the architectural patterns that actually contain prompt injection in 2026.
Read more: Prompt Injection Defense: 10 Tips That Hold UpKubernetes hardening for 2026: enforce Pod Security Standards, fix over-permissive RBAC, default-deny networking, and mitigate the CVEs nobody will patch.
Read more: Kubernetes Hardening 2026: RBAC, PSS & Unfixed CVEsHow to discover, scope, and govern service accounts, API keys, tokens, and AI agents before machine credentials become your breach path.
Read more: Non-Human Identity Governance: Field Tips for 2026Deep dives into infrastructure, security, and technical leadership. No noise, just engineering rigor. Subscribe and grab the infrastructure security checklist I work from.
Indra G. Prasetya
